NXD query monitor

ABSTRACT

Non-existent domain (NXD) queries may be monitored to determine if a keyword is included in NXD queries for a brand top level domain (TLD). When a predetermined number of NXD queries have been received for a brand domain that include the keyword, an action may be initiated. The action may be related to the registration of a new domain for the brand domain including the keyword.

BACKGROUND

The Internet enables a user of a client computer system to identify andcommunicate with millions of other computer systems located around theworld. A client computer system can identify each of these othercomputer systems using a unique numeric identifier for that computercalled an “IP address.” When a communication is sent from a clientcomputer system to a destination computer system, the client computersystem typically specifies the IP address of the destination computersystem in order to facilitate the routing of the communication to thedestination computer system. For example, when a request for a WorldWide Web page (“Web page”) is sent from a client computer system to aWeb server computer system (“Web server”) from which that Web page canbe obtained, the client computer system typically includes the IPaddress of the Web server.

In order to make the identification of destination computer systems moremnemonic, a Domain Name System (DNS) has been developed that translatesa unique alphanumeric name for a destination computer system into the IPaddress for that computer. Using domain names, a user attempting tocommunicate with this computer system could specify a destination of“comp23.example.com” rather than the particular IP address of thecomputer system (e.g., 198.81.209.25).

The alphanumeric name is called a “domain name.” For example, the domainname for a hypothetical computer system operated by Example Corporationmay be “exampleco.com”. “Exampleco.com” may be considered a brand domainname as it includes the name of the company. In other examples, thebrand domain name may include a string of characters, word, term,phrase, tradename, trademark, product name, service name, dba, etc.,that may identify or otherwise reflect the company. The brand domainname may include, together with the TLD and a brand domain, for example,“exampleco”, one or more lower-level domains for different pages withinthe brand website. In the example above, “shoes.exampleco.com”, “shoes”may be a lower-level domain. Thus, a user seeking to access informationrelated to shoes may understand that by entering the domain name“shoes.exampleco.com”, the user is accessing information related toshoes based on the lower-level domain included in the domain name.

BRIEF DESCRIPTION OF THE DRAWINGS

The accompanying drawings, which are incorporated in and constitute apart of this specification, illustrate, together with the description,examples of the present disclosure. In the figures:

FIG. 1 is an example system environment for monitoring NXD queriesand/or initiating an action, in accordance with one or more examplesdisclosed herein;

FIG. 2 is an example block diagram of components included in a devicefor monitoring NXD queries and/or initiating an action, in accordancewith one or more examples disclosed herein;

FIG. 3 is an example graphical user interface, in accordance with one ormore examples disclosed herein;

FIG. 4 is an example flow diagram of a method for initiating an action,in accordance with one or more examples disclosed herein;

FIG. 5 is an example flow diagram of a method for initiating monitoringof NXD queries, in accordance with one or more examples as discussedherein;

FIG. 6 is an example flow diagram of a method for initiating an action,in accordance with one or more examples as discussed herein;

FIG. 7 is an example flow diagram of a method for initiating an action,in accordance with one or more examples as discussed herein; and

FIG. 8 is an example computer system or apparatus that may be used as aplatform for executing the functionality discussed herein.

DETAILED DESCRIPTION

Companies and owners of brand names want to improve the experiences ofon-line users visiting their branded websites. Their branded websitesmay be accessed via brand domain names that include a brand domain. Thebrand domain may be a top-level domain, or a domain lower than thetop-level, such as a lower level domain. A brand domain name thatincludes the brand domain at the top level provides the opportunity forbranded corporations to use their corporate name or other uniqueidentifier (e.g. “.books”) as their website's top-level identifierinstead of using a more traditional .com or .biz top level domain. Forexample, Example Corporation may have a domain name as“shoes.exampleco”, instead of the traditional second level and top leveldomain “exampleco.com”. Users wishing to visit a branded website mayinput a lower-level domain within the .exampleco TLD based on a specificwebpage they are trying to access. However, regardless of whether thebrand domain is a TLD or a lower-level domain, if the company of thebranded website did not register the domain name including thelower-level domain entered by the user, the request may result in anon-existent domain (NXD) request where the user may experience a“server not found” message. Thus, the user's on-line experience may bediminished, and thus, the user's perception of the brand may bediminished. In other implementations, upon entry of an NXD request,instead of receiving an error, the user may be redirected to a searchengine web page where search results including a company's competitor'swebsites may be listed. This may result in not only the company's brandbeing diminished, but the company's competitor(s) receiving thecompany's business.

It may be appreciated that, in accordance with some examples asdiscussed herein, a domain name may be implemented as a fully qualifieddomain name that specifies its exact location in a tree hierarchy of theDNS. A fully qualified domain name may specify all specify all domainlevels, including the TLD and the root zone.

It may further be appreciated that, in accordance with some examples asdiscussed herein, a domain name may be implemented as including a TLD,for example, a generic TLD, a country-code TLD, an internationalizedcountry-code TLD, etc., and one or more lower level domains.

As discussed herein, a brand domain may be implemented in a domain name,where the brand domain may be a top-level domain, or a domain lower thanthe top-level domain, in other words, a lower-level domain.

As discussed herein, NXD queries may be monitored to determine if NXDqueries for a brand domain include a predetermined keyword, for examplein a lower-level domain. When a predetermined number (e.g., one oranother number) of NXD queries include the predetermined keyword, anaction may be initiated. The action may include registration of a domainname at a domain name registry or registrar, the domain name includingthe keyword, as a lower-level domain, and the brand domain or mayinclude other actions, for example, sending a communication to aregistrant of a brand domain name that includes the brand domain, etc.

In some examples, a predetermined keyword may include a string ofcharacters, such as a word or phrase that may be received via a userinterface, a related or proximity word or phrase of the string ofcharacters, singular and/or plural forms of the string of characters,related or proximity word, misspellings of the string of characters,related or proximity word, etc. For example, where a string ofcharacters, received at a user interface is “shoes”, the system maygenerate related or proximity words “flip-flops”, “sandals”, “heels”,etc. Thus, NXD queries may be monitored for the predetermined keywords“shoes”, “flip-flops”, “sandals”, “heels”, singular and/or pluralspellings of these words, and/or misspellings of these words. Thesepreferences may be set via a graphical user interface.

Where a large number of users input a domain name request including abrand domain and a lower-level domain that does not exist, an action maybe initiated that may result in registration of the domain nameincluding the keyword, thereby improving the user's on-line experienceas it relates to the brand, and thus, improving the user's perception ofthe brand.

In addition to, or alternatively, a graphical user interface may beprovided that enables an entity, such as a company having a brand domainname or a registrant of a brand domain name, to enter a keyword andinformation related to the keyword, for example, a number representingthe number of NXD queries the company would like to receive beforeinitiating an action, for example, registration of the Company's branddomain and the keyword as a domain name. Thus, when the predeterminednumber of NXD queries including the brand domain and the keyword havebeen received, an action may be initiated, for example, a domain nameincluding the brand domain and the keyword as a lower-level domain maybe registered, among other actions.

FIG. 1 depicts an example system environment for implementing featuresas discussed herein. It may be appreciated that additional elements maybe included in system environment 100 and some of the elements may beremoved and/or modified without departing from the spirit and scope ofthis disclosure.

As shown in FIG. 1, system environment 100 may include apparatus ordevice 102 including NXD monitoring application 103 for monitoring NXDqueries. Device 102 may be communicably linked to network 106. Devices104 a through 104 n may be implemented as client computing devices,administrative computing devices, etc. Devices 104 a through 104 n mayseek to access webpages at devices not shown in FIG. 1 via uniformresource locator (URL) requests to NameServer 110. These requests mayultimately result in access to the requested webpage if the domain namewas registered. However, where the URL includes a domain name that isnot registered, the request results in a (NXD) request.

Device 108 may be implemented as a computing device operated by acompany that hosts a brand domain website. The brand domain website maybe hosted at device 108 or at another computing device (not shown) insystem environment 100.

Device 102 may be implemented as a server, a mainframe computer, anycombination of these components, or any other appropriate computingdevice, resource service, for example, cloud, etc. Device 102 may bestandalone, or may be part of a subsystem, which may, in turn, be partof a larger system. It may be appreciated that, while device 102 may bedescribed as including various components, one or more of the componentsmay be located at other devices (not shown) within system environment100. As shown in FIG. 1, device 102 may include a NXD monitoringapplication 103 for monitoring NXD queries.

Client devices 104 a to 104 n may be implemented as any computingdevice, for example, a desktop computer, laptop computer, portablecomputing device, etc. Client devices 104 a to 104 n may seek access towebsites within system environment 100 by entering domain name requests.

NameServer 110 may be implemented as a computing device and maycommunicate with other devices within system environment 100. NameServer110 may receive domain name requests from client devices 104 a to 104 nand resolve the requests where the domain names are registered. Wherethe domain names are not registered, the domain name requests result inan NXD query. The NXD query may be stored locally, remotely, etc. Inaddition, the NXD query may monitored locally or remotely, as furtherdiscussed herein.

Additionally, devices 102, 104 a to 104 n, 108 and 110 includes thenecessary hardware and/or software needed to communicate with thenetwork 106 via a wired and/or a wireless connection. Device 102, 104 ato 104 n, 108 and 110 may be embodied by server computing devices,desktop/laptop/handheld computers, wireless communication devices,personal digital assistants or any other similar devices having thenecessary processing and communication capabilities. In an embodiment,the network 106 may comprise a public communication network such as theInternet or World Wide Web and/or a private communication network suchas a local area network (LAN), wide area network (WAN), etc. It may beappreciated that, in some examples, device 102 and NXD monitoringapplication 103 may be implemented as part of NameServer 110.

One or more of devices 102, 104 a to 104 n, 108 and 110 may comprise oneor more suitable computing devices to implement the functionality asdiscussed herein.

As discussed herein, devices 102, 104 a to 104 n, 108 and 110 includeone or more processors in communication with one or more storagedevices. The processor(s) may comprise a microprocessor,microcontroller, digital signal processor, co-processor or other similardevices known to those having ordinary skill in the art. Theapplications described herein may be implemented as either software,firmware and/or hardware applications and may be implemented as a set ofcomputer or machine-readable instructions stored in any type ofnon-transitory computer-readable or machine-readable storage medium orother storage device. Some non-limiting examples of non-transitorycomputer-readable mediums may be embodied using any currently knownmedia such as magnetic or optical storage media including removablemedia such as floppy disks, compact discs, DVDs, BLU-RAY, flash memory,hard disk drives, etc. In addition, the storage device(s) as discussedherein may comprise a combination of non-transitory, volatile ornonvolatile memory such as random access memory (RAM) or read onlymemory (ROM). One or more storage devices has stored thereoninstructions that may be executed by the one or more processors, suchthat the processor(s) implement the functionality described herein. Inaddition, or alternatively, some or all of the software-implementedfunctionality of the processor(s) may be implemented using firmwareand/or hardware devices such as application specific integrated circuits(ASICs), programmable logic arrays, state machines, etc.

FIG. 2 depicts an example configuration of device 200. Device 200 may beimplemented, for example, as device 102 depicted in FIG. 1. As shown inFIG. 2, device 200 may include keyword identification application 202,NXD monitoring application 204, NXD storage 206, action initiationapplication 208, keyword/reserved word storage 210, network interfaceapplication 212 and processor 214. It may be appreciated that additionalcomponents may reside at device 200 in order to further perform thefunctionality as discussed herein.

Keyword identification application 202 may enable entry of keywords andinformation associated with the keywords. Keyword identificationapplication 202 may provide a graphical user interface including aplurality of fields to be displayed on a display. The plurality offields may receive values input from a user at, for example, device 108,related to one or more keywords. With respect to each keyword enteredvia the graphical user interface, additional fields may be provided toenable entry of one or more of the following: a brand domain name, abrand domain, a forwarding URL, a number of instances an NXD query maybe received before an action may be initiated, one or more reservedwords, a time period or range in which the number of instances NXDqueries are received before an action may be initiated, etc. Inaddition, a field may be provided enabling entry of a time period andanother field enabling entry of a maximum number of actions, whereinonly the maximum number of actions may be initiated within theidentified time period.

Data received through the graphical user interface may be stored inkeyword/reserved word storage 210. This data may be accessed via NXDmonitoring application 204.

NXD storage 206 may include NXD queries that are received at NameServer110 and forwarded to device 102. NXD queries may be monitored via NXDmonitoring application 204 as the requests are received from theNameServer 110, or at a later time after the NXD queries are stored inNXD storage 206. While NXD storage 206 is depicted at device 200, it maybe appreciated that NXD storage 206 may reside in a different devicewithin system environment 100, where information related to the NXDqueries may be accessible by device 200.

NXD monitoring application 204 may monitor NXD queries, requests, etc.,for keywords that have been identified via the graphical user interfaceprovided by keyword identification application. In other words, in oneexample, as the NXD queries are received at device 102, a brand domainmay be identified in the NXD query. It may be determined whether thereare one or more keywords that are identified for monitoring. If thereare one or more keywords identified for monitoring for the brand domain,the NXD query is analyzed to determine if any of the keywords arepresent in the NXD query. If a keyword is present, an indication may bemade indicating as such. If a predetermined number of queries arereceived including the same keyword for the brand domain, an action maybe initiated. If a predetermined number has not been received,monitoring may continue.

Action initiation application 208 may initiate an action if isdetermined that a predetermined number of NXD queries have been receivedthat include a keyword for a brand domain. An action may include, forexample, one or more of the following: registering, for example at adomain name registry or registrar, a newly created domain name includingthe brand name and the keyword as a lower-level domain; transmitting acommunication to a registrant of the brand domain name indicating thatthe predetermined number of NXD queries have been received that includethe keyword; transmitting a communication to a registrant of the branddomain name inviting the registrant to register a new domain nameincluding the brand domain and the keyword as a lower-level domain, etc.In an example, the transmitted communication may include a link, forexample, to a Web page, that facilitates registration of a domain nameincluding the brand domain and the keyword as a lower-level domain.

Network interface application 212 facilitates network communicationbetween device 102 and other devices within system environment 100.

Processor 214 may execute computer-readable instructions, stored instorage, to perform methods, processes, operations, steps or otherfunctionality as described herein.

FIG. 3 depicts an example graphical user interface for managing keywordsthat are to be monitored. The graphical user interface may be displayedon a display at, for example, device 108, operated by, for example, theregistrant of the brand domain name, where device 108 may receive one ormore keywords, and information associated therewith, for monitoring asdiscussed herein. Information entered via the graphical user interfacemay be transmitted to device 102 and stored in keyword/reserved wordstorage 210 at, for example, device 102.

As show in FIG. 3, keywords 302 may include, in one or more panes, alist of keywords that may be used for monitoring with respect to a branddomain. As shown in keywords pane 302, keyword 304 “shoes” is identifiedfor a brand domain, namely “Exampleco”. The forwarding URL 306corresponding to keyword 304 “shoes” is identified ashttp://www1.exampleco.com/shop/shoes. The threshold 308 corresponding tokeyword 304 “shoes” is identified as 500. In various embodiments,threshold 308 is the number of NXD queries including the keyword thatare to be received before an action is initiated. Thus for the exampleshown, NXD queries will be monitored to count those requests includingbrand domain “exampleco” and including the keyword “shoes”. When 500requests including this brand domain and this keyword are received, aspecified action may be taken, such as registering “shoes.exampleco”and/or “shoes.exampleco.com” as a domain name. The forwarding URL,received via the graphical user interface, corresponding to the keyword“shoes” may be mapped to the newly registered domain name. Thus, when auser enters the newly registered domain name, the user may be taken tothe website at the forwarding URL. As the user is accessing the newlyregistered domain name, the user will not receive a “server not found”error.

It may be appreciated, according to some examples, that the keyword maybe a part of a larger string of characters of a lower level domain. Ifthe number of NXD queries including the larger string of characters forthe lower level domain exceeded the predetermined threshold, then a newdomain name, including the larger string as the lower level domaintogether with the brand domain and a top-level domain, may be registeredfor the brand domain name. For example, if the predefined keyword is“shoes”, and the NXD query includes “shoesby.exampleco.com”, the NXDquery would be considered as including the keyword. If the number of NXDqueries including “shoesby” in the lower level domain exceeded thepredetermined threshold, then an action may be taken as discussedherein, for example, the registration of a new domain name such as“shoesby.exampleco.com”.

A new keyword may be entered at field 310 for monitoring by the NXDmonitoring application 204. Upon the entry of a new keyword, it may beappreciated that additional fields may be presented in the graphicaluser interface to receive additional information related to the keyword,including the threshold 308, forwarding URL 306, a time period, etc.Information received via the fields in the graphical user interface maybe stored in keyword/reserved word storage 210 and utilized during themonitoring of the NXD queries.

Registration history 312 may be implemented as a pane that lists domainnames that were registered based on the receipt of the threshold(predetermined) number of NXD queries that included the brand domain anda keyword that was identified via the keyword identification application202.

It may be appreciated that the graphical user interface of FIG. 3 mayinclude additional information and fields for entry of additionalinformation related to the entry of keywords for monitoring. Forexample, time periods may be specified identifying a time period duringwhich the threshold number of NXD queries must be received before anaction may be initiated. As another example, the type of action may bespecified, for example, whether a domain name should be registered,whether a communication should be transmitted to a registrant of thebrand domain name, etc. As another example, one or more reserved wordsmay be entered via the graphical user interface. Reserved words may beused to check against registration or domain names that include wordsthe brand domain name registrant does not wish to register. Reservedwords may be, for example, derogatory words, or any other words that maybe designated. It may be appreciated that reserved words may, inaddition, or alternatively, be entered at device 102.

According to some examples, a “kill switch” functionality may beincorporated that may stop all writable transactions (for example, stopthe ability to register domain names, etc.). In other words, the killswitch may suspend the functionality to automatically register domainnames but may not impact the NXD monitoring or alert functionality.Therefore, a user logged into the tool may utilize interactive elementsin the user interface, for example, an actuatable button, pull downmenu, etc., to enable the kill switch to suspend future registrationsand not incur more fees, but may continue to have NXD traffic monitoredand provide alerts when a domain name containing a specified keywordexceeded a predetermined threshold. This functionality may be beneficialif there were an increased number of non-existent domain name queriesmonitored, for example, resulting from a bad actor or a misconfiguredserver. The kill switch may, in some examples, also be used toreactivate functionality after it had previously been used to stopwritable transactions from occurring. In some examples, if the killswitch is turned back on, domain names that had exceeded the thresholdduring the prior period may not be queued or registered automatically,and new domain names may only be registered if they exceeded thethreshold after reactivation. In another example, with respect to one ormore keywords, a value may be displayed indicating a current value ofhow many NXD queries were received that included the keyword, a currentvalue of how many NXD queries include the keyword for the current periodof time, a maximum number of NXD queries (regardless of the time period)of how many NXD queries included the keyword, etc.

FIG. 4 depicts an example flow diagram of a process for monitoring NXDqueries. The process depicted in FIG. 4 may be performed, for example,by device 102, device 200, etc. As shown in FIG. 4, NXD queries aremonitored (402). NXD queries for a brand domain may be monitored as theNXD queries are received by or from, for example, a NameServer 110 orfrom other devices within system environment 100. Alternatively,monitoring may be performed by accessing a plurality of NXD queriesstored in NXD storage 206.

A determination may be made whether a predetermined number of NXDqueries for a brand domain include a keyword (404). As noted above, oneor more keywords may be entered via keyword identification application202 and stored in keyword/reserved word storage 210. As the NXD queriesare monitored, they are checked to see whether they include a keywordfor a particular brand domain. As NXD queries are determined to includea keyword for a brand domain, an indication may be made, for example, acounter associated with the keyword may be incremented. A determinationmay be made whether the number of NXD queries received including thekeyword with respect to the brand domain has reached a predeterminedthreshold value. For example, the counter value counting the number ofNXD queries including the keyword for the brand domain may be comparedwith the threshold value, for example, entered via a graphical userinterface, to determine if the threshold value has been met.

An action may be initiated when it is determined that the predeterminednumber of NXD queries include the keyword with respect to the branddomain (406). For example, the action may be designated by theregistrant of the brand domain name, may be set by an administrator ofdevice 102, may be set by default, etc. The action may includeregistration of a domain name including the brand domain and thekeyword, where the keyword may be identified as a lower-level domain andassociated with the brand domain. The associated lower-level domain andbrand domain may be registered as a domain name such that the registrantof the brand domain name is registered as the registrant of theassociated lower-level domain and brand domain.

Alternatively, or in addition, the action may include transmitting acommunication to a registrant of the brand domain name identifying thelower-level domain. The communication may further indicate that thepredetermined threshold number of NXD queries including the keyword forthe brand domain has been reached.

In another example, the brand domain name registrant may designate, viathe graphical user interface, the action to be a two-step process, thefirst step including transmitting a communication to the registrantindicating the first threshold has been met. The NXD queries may befurther monitored to determine if a higher threshold value has been met.Once the higher threshold value has been met, the second step mayinclude registering a domain name including the keyword as a lower-leveldomain and the brand domain. In this example, both the first thresholdand the higher threshold value may be entered by a registrant via thegraphical user interface, entered by an administrator at device 200, setby default, etc.

In another example, prior to registration of the domain name includingthe keyword as the lower-level domain and the brand domain, anadditional check may be made to determine if the keyword is a reservedword. An example of a reserved word may be a derogatory word, or anyother word designated by the registrant of the brand domain name, anadministrator of device 102 or 200, etc. If the keyword is a reservedword, an alternative action may be taken. For example, a communicationmay be transmitted to the registrant of the brand domain name indicatingthat the predetermined number of NXD queries were received including thereserved word, the domain name including the reserved word and the branddomain may be barred from being registered, etc.

In another example, a determination may be made as to whether a maximumnumber of domain name registrations have been made by the processesdiscussed herein. This determination may be made with respect aparticular time period, for example, a period of hours, days, weeks,months, etc. The maximum number of registrations and the time period maybe entered via the graphical user interface by keyword identificationapplication 202. In this example, a number of new registrations for thebrand domain may be determined for a particular time period. Wheninitiating the action, the keyword as the lower-level domain may beassociated with the brand domain to create a new domain name andregistered only when the determined number of new registrations for thebrand domain during the predetermined time period is less than a maximumnumber of new registrations for the brand domain. This may protect thebrand domain name registrant from malicious users, bots, etc., which maygenerate large numbers of NXD queries including keywords, resulting in alarge number of registrations in a defined period of time.

In another example, initiation of an action may include initiatingfurther analysis of the NXD queries prior to registration. For example,once it is determined that a predetermined number of NXD queries includea keyword, calculation of a variance from the normal volume range of NXDqueries in the time period may occur. In another example, calculation ofthe deviation from the mean number of NXD queries in the time period,standard deviation, logarithmic distance, etc., may occur. Further, thenormal volume range may be adjusted based on calendar events, includinghour of the day, day of the week, month of the year, holiday or othercalendar events. By utilizing this statistical analysis, the system maynormalize traffic and compare NXD traffic with the normalized traffic.If there is a significant increase in the traffic, as predefined as athreshold by a user, then the keyword, as a lower level domain, combinedwith the brand domain, may be registered as a domain name.

FIG. 5 depicts an example flow diagram of a process for initiatingmonitoring of NXD queries. The process depicted in FIG. 5 may beperformed, for example, by device 102, device 200, etc. As shown in FIG.5, a graphical user interface may be provided (502). The graphical userinterface may be provided to device 108 and displayed on a display atdevice 108. The graphical user interface may include one or more fieldsthat may be configured to receive information as noted above, forexample, a keyword, a forwarding URL, a threshold value, etc. Thegraphical user interface may further include one or more additionalpanes that display information related to historical registrations,keywords and information associated with the keywords that have alreadybeen entered, etc., as noted above.

A keyword may be received via the field in the graphical user interface,a forwarding URL may be received via the forwarding URL field and athreshold value may be received via the threshold value field (504).Additional information may be received via the graphical user interfacerelated to the brand domain, the keyword, maximum number ofregistrations, etc., as noted herein.

Monitoring of NXD queries including the brand domain and the keywordreceived via the graphical user interface may be initiated (506).

An action may be initiated when a predetermined number of NXD queriesincluding the keyword exceed the threshold value received via thegraphical user interface. For example, the action may be designated bythe registrant of the brand domain name, may be set by an administratorof device 102, may be set by default, etc. The action may includeregistration of a domain name including the brand domain and thekeyword, where the keyword may be identified as a lower-level domain andassociated with the brand domain to create a new domain name. The newdomain name may be registered such that the registrant of the branddomain name is registered as the registrant of the new domain name.

Alternatively, or in addition, the action may include transmitting acommunication to a registrant of the brand domain name identifying thelower-level domain. The communication may further indicate that thepredetermined threshold number of NXD queries including the keyword forthe brand domain have been reached. In one example, the communicationmay include a link to facilitate registration of a new domain nameincluding the keyword and the brand domain.

In another example, the brand domain name registrant may designate, viathe graphical user interface, the action to be a two-step process, thefirst step including transmitting a communication to the registrantindicating the first threshold has been met. The NXD queries may befurther monitored to determine if a higher threshold value has been met.Once the higher threshold value has been met, the second step mayinclude registering a domain name including the keyword as thelower-level domain and the brand domain.

In another example, prior to registration of the domain name includingthe keyword as the lower-level domain and the brand domain, anadditional check may be made to determine if the keyword is a reservedword. An example of a reserved word may be a derogatory word, or anyother word designated by the registrant of the brand domain name, anadministrator of device 102 or 200, etc. If the keyword is a reservedword, an alternative action may be taken. For example, a communicationmay be transmitted to the registrant of the brand domain name indicatingthat a number of NXD queries were received including the reserved word,the domain name including the reserved word and the brand domain may notbe registered, etc.

In another example, a determination may be made as to whether a maximumnumber of domain name registrations have been made by the processesdiscussed herein. This determination may be made with respect aparticular time period, for example, a period of hours, days, weeks,months, etc. The maximum number of registrations and the time period maybe entered via the graphical user interface by keyword identificationapplication 202. In this example, a number of new registrations for thebrand domain may be determined for a particular time period. Wheninitiating the action, the keyword as the lower-level domain may beassociated with the brand domain to create a new domain name andregistered only when the determined number of new registrations for thebrand domain during the predetermined time period is less than a maximumnumber of new registrations for the brand domain. This may protect thebrand domain name registrant from malicious users, bots, etc., fromgenerating large amounts of NXD queries including keywords resulting ina large amount of registrations in a defined period of time.

In another example, initiation of an action may include initiatingfurther analysis of the NXD queries prior to registration. For example,once it is determined that a predetermined number of NXD queries includethe keyword, calculation of a variance from the normal volume range inthe time period may occur. In another example, calculation of thedeviation from the mean, standard deviation, logarithmic distance, etc.,may occur. Further, the normal volume range may be adjusted based oncalendar events, including hour of the day, day of the week, month ofthe year, holiday or other calendar events.

FIG. 6 depicts an example flow diagram of initiating an action. Theprocess shown in FIG. 6 may be performed, for example, by device 102,device 200, etc. As shown in FIG. 6, an NXD query may be received (602).The NXD query may be received, for example, from a client device 104 athrough 104 n, from NameServer 110, etc.

A determination may be made whether the received NXD query includes akeyword (604). For example, a brand domain may be determined, forexample, parsed, extracted, etc., from the received NXD query.Keyword/reserved word storage 210 may be accessed to determine if thereare any keywords associated with the brand domain determined from theNXD query. If there are one or more keywords associated with thedetermined brand domain, a determination is made whether keyword isincluded in the NXD query. If the NXD query includes the keyword, anindication may be made that an NXD query was received matching thekeyword. This may be done, for example, via one or more counters storedin, for example, keyword/reserved word storage. A counter associatedwith the keyword found in the NXD query may be incremented indicatingthe NXD query included the keyword.

Upon determining that the NXD query includes the keyword, adetermination may be made whether a predetermined number of received NXDqueries include the keyword (606). For example, the current value of thecounter counting the number of received NXD queries that include thekeyword may be compared to the threshold value received, for example,via the graphical user interface, set by default, etc.

Upon determining that the predetermined number of received NXD queriesinclude the keyword, for example, the current value of the countercounting the number of received NXD queries that include the keywordmatches or exceeds the threshold value, an action may be initiated(608).

For example, the action may be designated by the registrant of the branddomain name, may be set by an administrator of device 102, may be set bydefault, etc. The action may include registration of a newly createddomain name including the brand domain and the keyword, where thekeyword may be identified as a lower-level domain and associated withthe brand domain. The newly created domain name, including the keywordas the lower-level domain and the brand domain may be registered as adomain name where the registrant of the brand domain name is registeredas the registrant of newly created domain name. The forwarding URLreceived via the graphical user interface may be mapped to the newlycreated domain name.

Alternatively, or in addition, the action may include transmitting acommunication to a registrant of the brand domain name identifying thelower-level domain. The communication may further indicate that thepredetermined number of NXD queries including the keyword for the branddomain have been reached.

In another example, the brand domain name registrant may designate, viathe graphical user interface, the action to be a two-step process, thefirst step including transmitting a communication to the registrantindicating the first threshold has been met. The NXD queries may befurther monitored to determine if a higher threshold value has been met.Once the higher threshold value has been met, the second step mayinclude registering a domain name including the keyword as thelower-level domain and the brand domain.

In another example, prior to registration of the domain name includingthe keyword as the lower-level domain and the brand domain, anadditional check may be made to determine if the keyword is a reservedword. An example of a reserved word may be a derogatory word, or anyother word designated by the registrant of the brand domain name, anadministrator of device 102 or 200, etc. If the keyword is a reservedword, an alternative action may be taken. For example, a communicationmay be transmitted to the registrant of the brand domain name indicatingthat a number of NXD queries were received including the reserved word,the domain name including the reserved word and the brand domain may notbe registered, etc.

In another example, a determination may be made as to whether a maximumnumber of domain name registrations have been made by the processesdiscussed herein. This determination may be made with respect aparticular time period, for example, a period of hours, days, weeks,months, etc. The maximum number of registrations and the time period maybe entered via the graphical user interface by keyword identificationapplication. In this example, a number of new registrations for thebrand domain may be determined for a particular time period. Wheninitiating the action, the keyword may be used as the lower-level domainand associated with the brand domain to create a new domain name andregistered only when the determined number of new registrations for thebrand domain during the predetermined time period is less than a maximumnumber of new registrations for the brand domain. This may protect thebrand domain name registrant from malicious users, bots, etc., fromgenerating large amounts of NXD queries including keywords resulting ina large amount of registrations in a defined period of time.

In another example, initiation of an action may include initiatingfurther analysis of the NXD queries prior to registration. For example,once it is determined that a predetermined number of NXD queries includethe keyword, calculation of a variance from the normal volume range inthe time period may occur. In another example, calculation of thedeviation from the mean, standard deviation, logarithmic distance, etc.,may occur. Further, the normal volume range may be adjusted based oncalendar events, including hour of the day, day of the week, month ofthe year, holiday or other calendar events.

In some examples, during the monitoring process, where the keyword is aportion of a larger string of a lower level domain, the entire lowerlevel domain may be stored in association with an indication that an NXDquery was received. When the number of NXD queries including the largerstring has reached the predetermined threshold, an action may be taken.

FIG. 7 depicts an example flow diagram of a process for initiating anaction. The process depicted in FIG. 7 may be performed, for example, bydevice 102, device 200, etc. In the example in FIG. 7, assume the branddomain is “.example”. Further assume a registrant has entered a keyword“shoes”, “http://www1.example.com/shop/shoes” as the forwarding URL,“500” as a threshold value, and an indication that a domain nameincluding the brand domain and the keyword should be registered when thethreshold is met. No time period has been identified within which the500 NXD queries need to be received. A counter is associated with thekeyword “shoes” and initialized to “0”. Thus, these values may be storedin keyword/reserved word storage 210 and associated with “.example” asthe brand domain.

As shown in FIG. 7, an NXD query may be received (702). The NXD querymay be received, for example, from device 104 a through 104 n,NameServer 110, etc. In this example, the NXD query may be“www.shoes.example.com”.

The NXD monitoring application may determine, for example, by parsing,extracting, etc., the brand domain included in the NXD query (704). Inthis example, “.example” may be determined.

Monitoring application may access keyword/reserved word storage 210 todetermine if there are any stored keywords associated with the branddomain, namely example.com (706). In this example, “shoes” is stored inassociation with the brand domain, “.example”.

Processing proceeds to block 708 to determine if the received NXD queryincludes the identified keyword “shoes”. As the received NXD query“www.shoes.example.com” includes the keyword, processing proceeds toblock 710.

A counter associated with the keyword “shoes” is incremented to “1”(710).

A determination is made as to whether the threshold value of “500” hasbeen met (712). As the current value of the counter, namely “1”, doesnot equal the threshold value of “500”, processing proceeds to block 702to process the next received NXD query.

Once 500 queries are received that have the brand domain “.example”, andfurther include the keyword “shoes”, then processing may proceed toblock 714 where an action may be initiated. Based on the registrant'sentry via the graphical user interface, the domain name “shoes.example”is registered with a domain name registry. Alternatively,“shoes.example.com” may be registered with a domain name registry.

FIG. 8 illustrates a block diagram of a computing apparatus 800, such asthe device 200 depicted in FIG. 2, according to an example. In thisrespect, the computing apparatus 800 may be used as a platform forexecuting one or more of the functions described hereinabove.

The computing apparatus 800 includes one or more processors 802, such asthe processor(s) 214. The processor(s) 802 may be used to execute someor all of the steps, operations, or functions described in the methodsand processes depicted in FIGS. 4-7. Commands and data from theprocessor(s) 802 are communicated over a communication bus 804. Thecomputing apparatus 800 also includes a main memory 806, such as arandom access memory (RAM), where the program code for the processor(s)802, may be executed during runtime, and a secondary memory 808. Thesecondary memory 808 may include, for example, one or more hard diskdrives 810 and/or a removable storage drive 812, representing a floppydiskette drive, a magnetic tape drive, a compact disk drive, etc., wherea copy of the program code for the methods depicted in FIGS. 4-7 may bestored.

The removable storage drive 810 may read from and/or writes to aremovable storage unit 814 in a well-known manner. Input and outputdevices 816 may include a keyboard, a mouse, a display, etc. A displayadaptor 818 may interface with the communication bus 804 and the display820 and may receive display data from the processor(s) 802 and convertthe display data into display commands for the display 820. In addition,the processor(s) 802 may communicate over a network, for instance,network 106, the Internet, LAN, etc., through a network adaptor 822.

What is claimed is:
 1. A computer-implemented method, comprising:monitoring, using a computing apparatus, non-existent domain (NXD)queries including a brand domain; determining, using the computingapparatus, whether a predetermined number of the NXD queries include alower-level domain that matches a predetermined keyword; calculating avariance from a normal volume range of NXD queries in a time period;adjusting the normal volume range of NXD queries based on a calendarevent; determining that the variance from the normal volume range of NXDqueries in the time period is greater than a predetermined threshold;and initiating an action related to registration of a domain nameincluding the predetermined keyword when it is determined that thepredetermined number of NXD queries include the lower-level domain thatmatches the predetermined keyword and wherein the action is initiatedwhen it is determined that the variance from the normal volume range ofNXD queries in the time period is greater than the predeterminedthreshold.
 2. The computer-implemented method of claim 1, whereininitiating the action includes: associating the predetermined keyword asa lower-level domain with the brand domain to create a new domain name;and registering the new domain name.
 3. The computer-implemented methodof claim 1, wherein initiating the action includes: transmitting acommunication to a registrant of a brand domain name including the branddomain, the communication identifying the lower-level domain thatmatches the predetermined keyword.
 4. The computer-implemented method ofclaim 1, further comprising: calculating a deviation, standard deviationor logarithmic distance from a mean of a total number of NXD queries;determining that the deviation, standard deviation, or logarithmicdistance from the mean of the total number of NXD queries is greaterthan a predetermined threshold; and wherein the action is initiated whenit is determined that the deviation, standard deviation, or logarithmicdistance from the mean of the total number of NXD queries is greaterthan the predetermined threshold.
 5. The computer-implemented method ofclaim 2, further comprising: determining a number of new registrationsfor the brand domain during a predetermined time period, whereininitiating the action includes: associating the keyword as thelower-level domain with the brand domain to create a new domain name,and registering the new domain name only when the determined number ofnew registrations for the brand domain during the predetermined timeperiod is less than a maximum number of new registrations.
 6. Thecomputer-implemented method of claim 1, further comprising: determiningwhether the predetermined number of the NXD queries that include thelower-level domain that matches the predetermined keyword also include aderogatory word, wherein the action is initiated only when thepredetermined number of the NXD queries include the lower-level domainthat matches the predetermined keyword and does not include thederogatory word.
 7. A computer-implemented method, comprising: providinga user interface, the user interface including: a field to receive akeyword; and a field to receive a first threshold value; receiving akeyword via the field to receive the keyword and a first threshold valuevia the first threshold value field; initiating, using a computingapparatus, monitoring of non-existent domain (NXD) queries including abrand domain for the keyword received via the user interface;determining whether the predetermined number of the NXD queries thatinclude the lower-level domain that matches the predetermined keywordalso include a derogatory word; and initiating an action related toregistration of a domain name including the predetermined keyword when anumber of NXD queries including the keyword exceeds the first thresholdvalue, wherein the action is initiated only when the predeterminednumber of the NXD queries include the lower-level domain that matchesthe predetermined keyword and does not include the derogatory word. 8.The computer-implemented method of claim 7, wherein initiating theaction includes: associating the keyword as a lower-level domain withthe brand domain to create a new domain name; and registering the newdomain name.
 9. The computer-implemented method of claim 7, whereininitiating the action includes: transmitting a communication to aregistrant of a brand domain name including the brand domain, thecommunication identifying the keyword.
 10. The computer-implementedmethod of claim 7, wherein the user interface further includes a fieldto receive a second threshold value; and wherein initiating the actionincludes: transmitting a communication to a registrant of a brand domainname including the brand domain; and further monitoring NXD queries todetermine when additional NXD queries including the keyword exceed thesecond threshold value.
 11. The computer-implemented method of claim 7,the user interface further comprising: a field to receive a numberrepresenting the maximum number of registrations in a predetermined timeperiod.
 12. The computer-implemented method of claim 7, furthercomprising: calculating a variance from a normal volume range in a timeperiod; determining that the variance from the normal volume range inthe time period is greater than a predetermined threshold; and whereinthe action is initiated when it is determined that the variance from thenormal volume range in the time period is greater than the predeterminedthreshold.
 13. The computer-implemented method of claim 7, furthercomprising: calculating a deviation, standard deviation or logarithmicdistance from a mean; determining that the deviation, standarddeviation, or logarithmic distance from the mean is greater than apredetermined threshold; and wherein the action is initiated when it isdetermined that the deviation, standard deviation, or logarithmicdistance from the mean is greater than the predetermined threshold. 14.The computer-implemented method of claim 13, further comprising:adjusting the normal volume range based on a calendar event.
 15. Thecomputer-implemented method of claim 11, further comprising: determininga number of new registrations for the brand domain during apredetermined time period, wherein initiating the action includes:associating the keyword as a lower-level domain with the brand domain tocreate a new domain name, and registering the new domain name only whenthe determined number of new registrations for the brand domain duringthe predetermined time period is less the maximum number of newregistrations.
 16. The computer-implemented method of claim 7, whereinthe user interface further includes: a field to receive a forwardinguniversal resource locator (URL); and wherein initiating the actionincludes: associating the keyword as a lower-level domain with the branddomain to create a new domain name; registering the new domain name; andmapping the forwarding URL to the new domain name.
 17. Acomputer-implemented method, comprising: receiving a non-existent domain(NXD) query including a brand top-level domain (TLD); determining, usinga computing apparatus, whether the NXD query includes a keyword; upondetermining that the NXD query includes the keyword, determining whethera predetermined number of received NXD queries include the keyword;determining whether the predetermined number of the NXD queries thatinclude the keyword also include a reserved word; and upon determiningthat the predetermined number of received NXD queries include thekeyword, initiating, using the computing apparatus, an action related toregistration of a domain name including the brand domain and the keywordand wherein the action is initiated only when the predetermined numberof the NXD queries include the keyword and does not include the reservedword.
 18. The computer-implemented method of claim 17, whereininitiating the action includes: associating the keyword as a lower-leveldomain with the brand domain to create a new domain name; andregistering the new domain name.
 19. The computer-implemented method ofclaim 17, wherein initiating the action includes: transmitting acommunication to a registrant of a brand domain name including the branddomain, the communication including the keyword.
 20. Thecomputer-implemented method of claim 17, further comprising: calculatinga variance from a normal volume range in a time period; determining thatthe variance from the normal volume range in the time period is greaterthan a predetermined threshold; and wherein the action is initiated whenit is determined that the variance from the normal volume range in thetime period is greater than the predetermined threshold.
 21. Thecomputer-implemented method of claim 17, further comprising: calculatinga deviation, standard deviation or logarithmic distance from a mean;determining that the deviation, standard deviation, or logarithmicdistance from the mean is greater than a predetermined threshold; andwherein the action is initiated when it is determined that thedeviation, standard deviation, or logarithmic distance from the mean isgreater than the predetermined threshold.
 22. The computer-implementedmethod of claim 20, further comprising: adjusting the normal volumerange based on a calendar event.
 23. The computer-implemented method ofclaim 17, further comprising: determining a number of new registrationsfor the brand domain during a predetermined time period, whereininitiating the action includes: associating the keyword as a lower-leveldomain with the brand domain to create a new domain name, andregistering the new domain name only when the determined number of newregistrations for the brand domain during the predetermined time periodis less than a maximum number of new registrations.